v2.5.0

✨ Highlights

• 🔔 Alerts bell — an in-app inbox for finished and failed scans, plus a recent-activity feed on the start screen.
• 🚦 Scan queue — heavy scans (Amass, social-analyzer, maigret, git clones…) now wait for a free slot (SCAN_MAX_CONCURRENT_HEAVY, default 3) instead of exhausting memory. Optional BACKEND_MEM_LIMIT.
• 📜 Better history — paging, filtering, sorting, delete confirmation, live refresh of running scans, and JSON/CSV export.
• 🌐 Open it from anywhere — works by server IP or hostname out of the box; new guide for putting HTTPS in front. /docs and /redoc now open in the browser.
• 🧹 News retention that really deletes — default is now 30 days (was "forever"); articles with a note or AI analysis are always kept.

🚀 Deploy & updates

• ⚡ Much faster image builds (pinned release binaries for subfinder/httpx/amass) and near-instant up --wait.
• 🔖 ./update.sh <version> updates or rolls back to a specific release; images are pinned via CORVID_VERSION.
• 💾 Pre-migration backups are taken only when a migration is actually pending.
• 🛡️ New guide: route all outbound traffic through a VPN sidecar.

🔧 Fixes

Weekly live checks now cover the keyless sources, and found five broken ones:

• OpenPhish feed moved, address-blacklist (OpenSanctions) redirect, DuckDuckGo ads leaking into dork results — fixed.
• Dark Reading has a new feed URL (existing installs migrate automatically); SecurityWeek blocks all clients and was removed from the defaults.
• 🔑 MalwareBazaar now needs an abuse.ch key — add it under Settings → API Keys (same key as ThreatFox and URLhaus).

⬆️ Upgrading

Re-download docker-compose.prod.yaml and update.sh (or re-run the installer), then ./update.sh. Non-SQLite DB_URL values now fail at startup — SQLite was the only supported database already.